Skip to content

Commit b301211

Browse files
committed
fix(oembed): validate provider data before populating list
1 parent 1684c57 commit b301211

2 files changed

Lines changed: 14 additions & 11 deletions

File tree

src/wp-includes/class-wp-oembed.php

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,9 @@ class WP_oEmbed {
2323
* A list of oEmbed providers.
2424
*
2525
* @since 2.9.0
26-
* @var array
26+
* @var array<string, array{ 0: string, 1: bool }> An associative array mapping URL patterns to provider data.
27+
* Each entry's value is an array with the provider endpoint URL
28+
* string at index 0 and a boolean regex flag at index 1.
2729
*/
2830
public $providers = array();
2931

@@ -222,24 +224,25 @@ public function __construct() {
222224
* @since 2.9.0
223225
*
224226
* @param array<string, array{ 0: string, 1?: bool }> $providers An associative array mapping URL patterns to
225-
* provider data. Each value must be an array
226-
* with a provider endpoint URL string at index 0
227-
* and an optional boolean regex flag at index 1.
227+
* provider data. Each value must be an array
228+
* with a provider endpoint URL string at index 0
229+
* and an optional boolean regex flag at index 1.
228230
*/
229-
$this->providers = apply_filters( 'oembed_providers', $providers );
230-
231-
foreach ( $this->providers as $matchmask => $data ) {
231+
$providers = apply_filters( 'oembed_providers', $providers );
232+
foreach ( $providers as $matchmask => $data ) {
232233
if ( ! is_array( $data ) || ! isset( $data[0] ) || ! is_string( $data[0] ) ) {
233234
_doing_it_wrong(
234-
'oembed_providers',
235+
__METHOD__,
235236
sprintf(
236237
/* translators: %s: The oEmbed provider URL pattern. */
237238
__( 'The oEmbed provider data for %s is malformed. Each provider must be an array with a provider endpoint URL string at index 0 and an optional boolean regex flag at index 1.' ),
238239
'<code>' . esc_html( (string) $matchmask ) . '</code>'
239240
),
240241
'7.1.0'
241242
);
242-
unset( $this->providers[ $matchmask ] );
243+
} else {
244+
$data[1] = (bool) ( $data[1] ?? false );
245+
$this->providers[ $matchmask ] = $data;
243246
}
244247
}
245248

tests/phpunit/tests/oembed/wpOembed.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -282,7 +282,7 @@ public function test_wp_filter_pre_oembed_result_multisite_restores_state_if_no_
282282
*
283283
* @covers WP_oEmbed::__construct
284284
*/
285-
public function test_malformed_provider_triggers_doing_it_wrong_and_is_removed() {
285+
public function test_malformed_provider_triggers_doing_it_wrong() {
286286
$filter = static function ( $providers ) {
287287
$providers['bad_provider'] = array(
288288
'url' => '#https?://example\.site/.*#i',
@@ -292,7 +292,7 @@ public function test_malformed_provider_triggers_doing_it_wrong_and_is_removed()
292292
};
293293

294294
add_filter( 'oembed_providers', $filter );
295-
$this->setExpectedIncorrectUsage( 'oembed_providers' );
295+
$this->setExpectedIncorrectUsage( 'WP_oEmbed::__construct' );
296296
$oembed = new WP_oEmbed();
297297
remove_filter( 'oembed_providers', $filter );
298298

0 commit comments

Comments
 (0)